[PATCH v8 05/14] rv: Add a KUnit test for the storage free path

@@ -3,12 +3,16 @@
  * KUnit tests for RV hybrid automata (HA) framework
  */
 #include <kunit/test.h>
+#include <linux/atomic.h>
+#include <linux/delay.h>
 #include <linux/rv.h>
 
 #if IS_ENABLED(CONFIG_RV_HA_MONITOR)
 
 #include <rv_trace.h>
 
+static atomic_t rvtest_expired;
+
 /* rvtest: a minimal per-object HA monitor driven directly by the tests. */
 #define MONITOR_NAME rvtest
 #define RV_MON_TYPE RV_MON_PER_OBJ

@@ -19,7 +23,7 @@ typedef void *monitor_target;
 #define trace_rv_retries_error(...)	do { } while (0)
 #define trace_event_rvtest(...)		do { } while (0)
 #define trace_error_rvtest(...)		do { } while (0)
-#define trace_error_env_rvtest(...)	do { } while (0)
+#define trace_error_env_rvtest(...)	atomic_inc(&rvtest_expired)
 
 enum states_rvtest {
 	idle_rvtest,

@@ -134,8 +138,53 @@ static void rv_test_rvtest_underflow(struct kunit *test)
 	rv_this.enabled = 0;
 }
 
+/*
+ * rv_test_rvtest_arm_after_destroy - a storage outlived by its own timer
+ *
+ * da_destroy_storage() cancels the timer, then unlinks:
+ *
+ *	da_monitor_reset_hook()		cancels
+ *	hash_del_rcu()
+ *	call_rcu()
+ *
+ * A reader that resolved the storage before the unlink can arm past that
+ * cancel.  Handlers resolve and use under one guard(rcu)(), so the two steps
+ * are issued separately here.
+ *
+ * The timer is still queued after the destroy, and it fires -- reporting a
+ * violation for an entity that is gone.
+ */
+static void rv_test_rvtest_arm_after_destroy(struct kunit *test)
+{
+	const int id = 4242;
+	struct da_monitor *stale;
+
+	atomic_set(&rvtest_expired, 0);
+	da_monitor_init();
+	rv_this.enabled = 1;
+
+	da_handle_start_run_event(id, NULL, start_rvtest);
+
+	scoped_guard(rcu)			/* resolve before the unlink */
+		stale = da_get_monitor(id, NULL);
+	KUNIT_ASSERT_NOT_NULL(test, stale);
+
+	da_destroy_storage(id);			/* cancel, unlink, call_rcu */
+	ha_start_timer_ns(to_ha_monitor(stale), clk_rvtest,
+			  RVTEST_BUDGET_NS, ha_get_ns());
+
+	rcu_barrier();
+
+	/* A timer the free path missed expires here. */
+	msleep(600);
+	KUNIT_EXPECT_EQ(test, atomic_read(&rvtest_expired), 0);
+	da_monitor_destroy();
+	rv_this.enabled = 0;
+}
+
 static struct kunit_case rv_ha_kunit_cases[] = {
 	KUNIT_CASE(rv_test_rvtest_underflow),
+	KUNIT_CASE(rv_test_rvtest_arm_after_destroy),
 	{}
 };